SuSe: qpopper privilege escalation
Summary
______________________________________________________________________________
SuSE Security Announcement
Package: qpopper
Announcement-ID: SuSE-SA:2003:018
Date: Friday, Mar 21th 2003 10:11 MET
Affected products: 7.3, 8.0, 8.1
SuSE Linux Enterprise Server 8
Vulnerability Type: remote system compromise
Severity (1-10): 3
SuSE default package: no
Cross References: CAN-2003-0143
Content of this advisory:
1) security vulnerability resolved: buffer overflow
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds:
- mutt
- kernel
- ethereal
- apcupsd
- vnc
- openssl
- mod_php4
- pgp4pine
- nethack
- netpbm
- man
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
The Post-Office-Protocol- (POP-) Server qpopper (version 4) was
vulnerable to a buffer overflow. The buffer overflow occurs after
authentication has taken place. Therefore pop-users with a valid
account can execute arbitrary code on the system running qpopper.
Depending on the setup, the malicious code is run with higher privileges.
There is no temporary fix known, please update your system.
Please download the update package for your distribution and verify its
integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command "rpm -Fhv file.rpm" to apply
the update.
Our maintenance customers are being notified individually. The packages
are being offered to install from the maintenance web.
Please note, missing packages will be published as soon as possible.
Intel i386 Platform:
SuSE-8.1:
45017728d71adab5aa1b335878666369
patch rpm(s):
06c56a877950b5285164b77e7818a3df
source rpm(s):
c8e7be3433bddadc73aac4251faa9b27
SuSE-8.0:
e62034de0ab73f1f563950a34047493f
patch rpm(s):
0f0b17a2efd99edb840b559095d5b8f0
source rpm(s):
2e8023638bd7c5d71ac5fe55f9bd6036
______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- mutt
A buffer overflow in mutt's IMAP code may result in remote system
compromise.
New packages are currently being build and will be available soon.
- kernel
A bug in the Linux kernel was found that allows local users to
become root. The bug can just be exploited if ptrace(2) is allowed,
LKM and kmod support is enabled.
We already build new kernels and are currently testing them.
As a workaround kernel module loading can be disabled after every
boot by executing the following action as root:
# echo /just/a/temporary/workaround > /proc/sys/kernel/modprobe
Please note, that this will disable some services.
- ethereal
A format string bug in ethereal's SOCKS handling code and a buffer
overflow in the NTLMSSP was found in ethereal. Both bugs may lead
to remote system compromise.
New packages are currently being build and will be available soon.
- apcupsd
The control and management daemon for APC UPS systems is vulnerable
to remote code execution due to buffer overflow and format string bugs.
A dedicated advisory for this issue will be released as soon as all
packages are being build.
- vnc
VNC (Virtual Network Computing) uses a weak cookie generation process
which can be exploited by an attacker to bypass authentication.
New packages are currently being tested and will be available on our
FTP servers soon.
- openssl
A paper regarding remote timing attacks against OpenSSL has been
published by researchers of the Stanford University. It is possible
to extract the private RSA key used by services using OpenSSL by
observing their timing behavior.
Additionally czech researchers found another bug in OpenSSL which
is an extension of the "Bleichenbacher Attack".
Fixed packages will be available on our FTP servers soon.
- mod_php4 4.3.0
A serious security vulnerability was found in mod_php 4.3.0 which
allows a remote attacker to read files or even execute PHP-code.
This was possible due to direct access to the CGI module.
SuSE does not ship this vulnerable version.
- pgp4pine
A buffer overflow in pine's filter add-on pgp4pine can be abused
to execute arbitrary commands remotely. The pgp4pine version
SuSE ships is not vulnerable to this bug.
- nethack
A buffer overflow in nethack can be exploited local users to gain
higher privileges if the nethack binary is installed setuid/setgid.
This bug is fixed for upcoming SuSE Linux versions. As a temporary
workaround you should disable all s-bits on the nethack binary
(/etc/permissions.local).
- netpbm
The netpbm package contains various integer overflows which can
lead to arbitrary code execution. New packages are published on our
FTP servers.
- man
A vulnerability in man was published that allows local privilege
escalation. SuSE Linux does not ship this vulnerable version of man.
______________________________________________________________________________
3) standard appendix: authenticity verification, additional information
- Package authenticity verification:
SuSE update packages are available on many mirror ftp servers all over
the world. While this service is being considered valuable and important
to the free and open source software community, many users wish to be
sure about the origin of the package and its content before installing
the package. There are two verification methods that can be used
independently from each other to prove the authenticity of a downloaded
file or rpm package:
1) md5sums as provided in the (cryptographically signed) announcement.
2) using the internal gpg signatures of the rpm package.
1) execute the command
md5sum
References
